OpenAPITools / OpenAPITools/openapi-generator

[BUG] [csharp] Uri parameter injection in Uri path escapes reserved Uri characters

Open
#18,111 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue: Bug
Dominant language
Java
Stars
26.8k
Forks
7.7k
PR merge metrics
PR metrics pending

Description

Bug Report Checklist
  • Have you provided a full/minimal spec to reproduce the issue?
  • Have you validated the input using an OpenAPI validator (example)?
  • Have you tested with the latest master to confirm the issue still exists?
  • Have you searched for related issues/PRs?
  • What's the actual output vs expected output?
  • [Optional] Sponsorship to speed up the bug fix or feature request (example)
Description

Valid and distinct urls such as "http://example.com/@test" get escaped to "http://example.com/%40test".

Referencing these 2 SO posts:
Must '@' and '%40' be treated equivalently in URL paths?
Can I use an at symbol (@) inside URLs?

It should output the url path with the reserved character unescaped.

openapi-generator version

7.0.1
Looks to be in 7.4 too.

OpenAPI declaration file content or url
Generation Details

"generatorName": "csharp",
"library": "httpclient",

Steps to reproduce

Generate any endpoint that injects into a path like "/bulk/{job_id}"
Call that endpoint on the client with an id that includes the '@' character.
Observe the outgoing http request from the generated client will be made to a url with the escaped '%40'

Related issues/PRs

I didn't see any.

Suggest a fix

Looking at the code, WebRequestPathBuilder uses Uri.EscapeDataString in the Uri Path section when it should be using Uri.EscapeUriString:

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with modules/openapi-generator/src/main/resources/csharp/WebRequestPathBuilder.mustache and reproduce a generated csharp httpclient endpoint with a path parameter containing '@'. Compare the outgoing URL with the issue's expected unescaped path, and verify that reserved characters are handled correctly without changing unrelated path escaping.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.